---
layout: docs
page_title: Configure the Vault EKM provider
description: Configuration options for the Vault EKM Provider for Microsoft SQL Server.
---

> [!IMPORTANT]  
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.

# Configure the Vault EKM provider

Configuration is stored in a `config.json` file under ProgramData in a path that
mirrors the installation folder. This defaults to
`C:\ProgramData\HashiCorp\Transit Vault EKM Provider\config.json`.

-> **Note:** If the Vault EKM Provider has already been installed, Microsoft
    SQL Server needs to be restarted for configuration changes to take effect.

The following options are supported:

- `vaultApiBaseUrl` `(string: required)` - Address of Vault server, e.g.
    `https://vault.example.com:8200`
- `enableTrace` `(bool: false)` - Enable trace logging. Logs are viewable from
    the event viewer. See [troubleshooting](/vault/docs/platform/mssql/troubleshooting)
    for further details.
- `namespace` `(string: "")` - Set the Vault namespace to use. Applies to both
    AppRole and Transit.
- `appRoleMountPath` `(string: "approle")` - Use this to specify the path to the
    AppRole auth mount if it was set to a non-default path.
- `transitMountPath` `(string: "transit")` - Use this to specify the path to the
    Transit mount if it was set to a non-default path.
